WHAT IS CLAIMED IS: 



1 . A system for early warning in an e-service management system, comprising: 
a statistical learning mechanism for performing statistical learning based on a 

plurality of data values of a variable to generate a statistical model characterizing the 
behavior of the variable; 

an early warning mechanism for generating an early warning of threshold violation of 
the variable with respect to a threshold by predicting, based on the statistical model, a future 
time by which the values of the variable exceeds the threshold; and 

an operational mechanism for detecting abnormal behavior of the variable based on 
both the statistical model and the early warning. 

2. The system according to claim 1, wherein the statistical learning mechanism 
comprises: 

an offline normal behavior modeling mechanism for modeling the regular behavior of 
the variable based on the plurality of values of the variable collected offline over a period of 
time; and 

an online behavior modeling mechanism for modaling the dynamic behavior of the 
variable based on a plurality of values of the variable collected online during the operations 
performed by the operational mechanism. 

3 . A method for early warning in an e-service management system, comprising: 
modeling the behavior of a variable based on a plurality of data values of the variable 

collected over a period of time, said modeling being performed based on the statistical 
properties of the data values of the variable to generate a behavior model for the variable, the 
behavior model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
model; 

detecting abnormal behavior of the variable according to the plurality of data values 
of the variable collected online and the early warning. 
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4. The method according to claim 3, wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical 

model that characterizes the regular behavior of the variable based on a first set of values of 
the variable collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

5. The method according to claim 3, wherein generating an early warning 
comprises: 

computing a plurality of residuals at corresponding different time reference points in 
the future based on the model parameters; 

deriving the variances of the plurality of residuals, predicted by said predicting; 

estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability 
for threshold violation of the variable exceeds a pre-determined value. 

6. The method according to claim 5, wherein the estimating the probabilities 
comprises: 

translating the threshold for the variable to corresponding residual threshold for the 
residual of the variable; 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 

7. A computer-readable medium encoded with a program for early warning in an 
e-service management system, the program, when executed, causing: 

modeling the behavior of a variable based on a plurality of data values of the variable 
collected over a period of time, said modeling being performed based on the statistical 
properties of the data values of the variable to generate a behavior model for the variable, the 
behavior model being represented using a plurality of model parameters; 

generating an early warning for a threshold violation of the variable with respect to a 
threshold based on a plurality of data values of the variable collected online and the behavior 
model; 
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detecting abnormal behavior of the variable according to the plurality of data values 
of the variable collected online and the early warning. 

8. The medium according to claim 7, wherein the modeling comprises: 
establishing, by an offline normal behavior modeling mechanism, a first statistical 

model that characterizes the regular behavior of the variable based on a first set of values of 
the variable collected offline over a period of time; and 

establishing a second statistical model that characterizes the dynamic behavior of the 
variable based on a second set of values of said variable collected online, said first and said 
second statistical model comprising said behavior model. 

9. The medium according to claim 7, wherein generating an early warning 
comprises: 

computing a plurality of residuals at corresponding different time reference points in 
the future based on the model parameters; 

deriving the variances of the plurality of residuals, predicted by said predicting; 

estimating the probabilities for threshold violation of the variable with respect to said 
threshold at the corresponding different time reference points in the future; and 

issuing an early warning for any of the time reference points at which the probability 
for threshold violation of the variable exceeds a pre-determined value. 

1 0. The medium according to claim 9, wherein the estimating the probabilities 
comprises: 

translating the threshold for the variable to corresponding residual threshold for the 
residual of the variable; 

calculating the probabilities for threshold violation of the residual with respect to the 
residual threshold at the corresponding different time reference points in the future. 
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